The outlet 404 Media drew attention to a leak posted on the GrapheneOS forums. An anonymous insider using the handle rogueFed published screenshots from a closed Cellebrite briefing for law enforcement. The images show which Google Pixel smartphone models are vulnerable to the company’s hacking tools. It turns out the custom GrapheneOS protects devices better than Google’s stock system.
Israeli company Cellebrite positions itself as an independent digital forensics firm that specializes in extracting data from mobile devices. Cellebrite develops tools that are used by law enforcement, intelligence agencies, and private companies worldwide to extract data from smartphones and other devices.
Cellebrite usually keeps the details of its tools under wraps, but the leak outlines Cellebrite’s capabilities for the Pixel 6, 7, 8, and 9 phones (the Pixel 10, released a few months ago, is not on the list).
Supported devices are divided into three statuses:
- BFU (Before First Unlock) — the phone has not been unlocked after a reboot, all data is encrypted. Traditionally, this state is considered the most secure.
- AFU (After First Unlock) — the device has been unlocked at least once after boot. Data extraction in this state is considered easier.
- Unlocked — the phone is unlocked. Access to data is open.
According to leaked rogueFed materials, Cellebrite’s tools can extract data from stock firmware devices (Google Pixel 6, 7, 8, and 9) in all three states — BFU, AFU, and Unlocked. However, the company’s tools cannot brute-force passcodes to gain full control of the device. Law enforcement also cannot yet copy eSIMs from Pixel devices (notably, the Pixel 10 completely dropped physical SIM cards).
However, the picture changes noticeably for devices running GrapheneOS. Cellebrite representatives told law enforcement that access is only possible for devices running versions of GrapheneOS older than late 2022. Since the Pixel 8 and 9 were released after that date, devices in BFU and AFU states are protected against Cellebrite’s tools.
Moreover, it has emerged that since late 2024, even from a fully unlocked device running GrapheneOS it is impossible to extract data, and access is limited only to what is available to the user themselves.
GrapheneOS (formerly known as CopperheadOS) is an AOSP-based firmware with a strong focus on user privacy and security. It can be installed on select phone models, including Pixel, and is shipped without Google services. The system is popular among users who value privacy. We recently dedicated a separate article to GrapheneOS here.
It is worth noting that, according to rogueFed, he joined two closed-door Cellebrite briefings and went unnoticed. In one of the published screenshots, the insider also revealed the name of the meeting organizer. Journalists suggest that after this leak, Cellebrite will likely tighten vetting of participants in such online briefings.